@naylence/runtime 0.3.16 → 0.3.17

package/dist/browser/index.cjs

@@ -515,12 +515,12 @@ async function ensureRuntimeFactoriesRegistered(registry = factory.Registry) {
 }
 
 // This file is auto-generated during build - do not edit manually
-// Generated from package.json version: 0.3.16
+// Generated from package.json version: 0.3.17
 /**
  * The package version, injected at build time.
  * @internal
  */
-const VERSION = '0.3.16';
+const VERSION = '0.3.17';
 
 let initialized = false;
 const runtimePlugin = {
@@ -34710,6 +34710,7 @@ class OAuth2AuthorizerFactory extends AuthorizerFactory {
             defaultTtlSec: normalized.defaultTtlSec,
             maxTtlSec: normalized.maxTtlSec,
             reverseAuthTtlSec: normalized.reverseAuthTtlSec,
+            enforceTokenSubjectNodeIdentity: normalized.enforceTokenSubjectNodeIdentity,
         };
         if (tokenIssuer) {
             authorizerOptions.tokenIssuer = tokenIssuer;
@@ -34777,6 +34778,11 @@ function normalizeConfig$c(config) {
         : typeof source.reverse_auth_ttl_sec === 'number'
             ? source.reverse_auth_ttl_sec
             : DEFAULT_REVERSE_AUTH_TTL_SEC;
+    const enforceTokenSubjectNodeIdentity = typeof source.enforceTokenSubjectNodeIdentity === 'boolean'
+        ? source.enforceTokenSubjectNodeIdentity
+        : typeof source.enforce_token_subject_node_identity === 'boolean'
+            ? source.enforce_token_subject_node_identity
+            : false;
     const tokenVerifierConfigInput = source.tokenVerifierConfig ?? source.token_verifier_config ?? null;
     const tokenVerifierConfig = normalizeTokenVerifierConfig({
         config: tokenVerifierConfigInput,
@@ -34795,6 +34801,7 @@ function normalizeConfig$c(config) {
         maxTtlSec,
         tokenVerifierConfig,
         reverseAuthTtlSec: reverseAuthCandidate,
+        enforceTokenSubjectNodeIdentity,
         ...(audience ? { audience } : {}),
     };
     if (tokenIssuerConfig) {
@@ -39832,6 +39839,10 @@ function normalizeOptions$4(raw) {
             : typeof snake.aud === 'string'
                 ? snake.aud
                 : undefined);
+    const enforceTokenSubjectNodeIdentity = camel.enforceTokenSubjectNodeIdentity ??
+        (typeof snake.enforce_token_subject_node_identity === 'boolean'
+            ? snake.enforce_token_subject_node_identity
+            : undefined);
     return {
         tokenVerifier,
         tokenIssuer,
@@ -39841,6 +39852,7 @@ function normalizeOptions$4(raw) {
         defaultTtlSec,
         maxTtlSec,
         reverseAuthTtlSec,
+        enforceTokenSubjectNodeIdentity,
     };
 }
 class OAuth2Authorizer {
@@ -39854,6 +39866,8 @@ class OAuth2Authorizer {
         this.requireScope = options.requireScope ?? true;
         this.reverseAuthTtlSec =
             options.reverseAuthTtlSec ?? DEFAULT_REVERSE_AUTH_TTL_SEC;
+        this.enforceTokenSubjectNodeIdentity =
+            options.enforceTokenSubjectNodeIdentity ?? false;
     }
     get tokenVerifier() {
         return this.tokenVerifierImpl;
@@ -39983,6 +39997,13 @@ class OAuth2Authorizer {
             });
             return undefined;
         }
+        // Enforce token subject node identity if enabled
+        if (this.enforceTokenSubjectNodeIdentity) {
+            const validationResult = await this.validateTokenSubjectNodeIdentity(frame.systemId, claims);
+            if (!validationResult) {
+                return undefined;
+            }
+        }
         claims.instance_id = claims.instance_id ?? frame.instanceId;
         claims.assigned_path = claims.assigned_path ?? frame.assignedPath;
         claims.accepted_capabilities =
@@ -40060,6 +40081,33 @@ class OAuth2Authorizer {
         }
         return false;
     }
+    async validateTokenSubjectNodeIdentity(systemId, claims) {
+        const sub = claims.sub;
+        if (typeof sub !== 'string' || sub.trim().length === 0) {
+            logger$3.warning('oauth2_attach_missing_subject_claim', {
+                system_id: systemId,
+            });
+            return false;
+        }
+        const expectedPrefix = await core.generateIdAsync({
+            mode: 'fingerprint',
+            material: sub,
+            length: 8,
+        });
+        if (!systemId.startsWith(`${expectedPrefix}-`)) {
+            logger$3.warning('oauth2_attach_node_identity_mismatch', {
+                system_id: systemId,
+                expected_prefix: expectedPrefix,
+                subject: sub,
+            });
+            return false;
+        }
+        logger$3.debug('oauth2_attach_node_identity_verified', {
+            system_id: systemId,
+            expected_prefix: expectedPrefix,
+        });
+        return true;
+    }
 }
 
 var oauth2Authorizer = /*#__PURE__*/Object.freeze({

package/dist/browser/index.mjs

@@ -513,12 +513,12 @@ async function ensureRuntimeFactoriesRegistered(registry = Registry) {
 }
 
 // This file is auto-generated during build - do not edit manually
-// Generated from package.json version: 0.3.16
+// Generated from package.json version: 0.3.17
 /**
  * The package version, injected at build time.
  * @internal
  */
-const VERSION = '0.3.16';
+const VERSION = '0.3.17';
 
 let initialized = false;
 const runtimePlugin = {
@@ -34708,6 +34708,7 @@ class OAuth2AuthorizerFactory extends AuthorizerFactory {
             defaultTtlSec: normalized.defaultTtlSec,
             maxTtlSec: normalized.maxTtlSec,
             reverseAuthTtlSec: normalized.reverseAuthTtlSec,
+            enforceTokenSubjectNodeIdentity: normalized.enforceTokenSubjectNodeIdentity,
         };
         if (tokenIssuer) {
             authorizerOptions.tokenIssuer = tokenIssuer;
@@ -34775,6 +34776,11 @@ function normalizeConfig$c(config) {
         : typeof source.reverse_auth_ttl_sec === 'number'
             ? source.reverse_auth_ttl_sec
             : DEFAULT_REVERSE_AUTH_TTL_SEC;
+    const enforceTokenSubjectNodeIdentity = typeof source.enforceTokenSubjectNodeIdentity === 'boolean'
+        ? source.enforceTokenSubjectNodeIdentity
+        : typeof source.enforce_token_subject_node_identity === 'boolean'
+            ? source.enforce_token_subject_node_identity
+            : false;
     const tokenVerifierConfigInput = source.tokenVerifierConfig ?? source.token_verifier_config ?? null;
     const tokenVerifierConfig = normalizeTokenVerifierConfig({
         config: tokenVerifierConfigInput,
@@ -34793,6 +34799,7 @@ function normalizeConfig$c(config) {
         maxTtlSec,
         tokenVerifierConfig,
         reverseAuthTtlSec: reverseAuthCandidate,
+        enforceTokenSubjectNodeIdentity,
         ...(audience ? { audience } : {}),
     };
     if (tokenIssuerConfig) {
@@ -39830,6 +39837,10 @@ function normalizeOptions$4(raw) {
             : typeof snake.aud === 'string'
                 ? snake.aud
                 : undefined);
+    const enforceTokenSubjectNodeIdentity = camel.enforceTokenSubjectNodeIdentity ??
+        (typeof snake.enforce_token_subject_node_identity === 'boolean'
+            ? snake.enforce_token_subject_node_identity
+            : undefined);
     return {
         tokenVerifier,
         tokenIssuer,
@@ -39839,6 +39850,7 @@ function normalizeOptions$4(raw) {
         defaultTtlSec,
         maxTtlSec,
         reverseAuthTtlSec,
+        enforceTokenSubjectNodeIdentity,
     };
 }
 class OAuth2Authorizer {
@@ -39852,6 +39864,8 @@ class OAuth2Authorizer {
         this.requireScope = options.requireScope ?? true;
         this.reverseAuthTtlSec =
             options.reverseAuthTtlSec ?? DEFAULT_REVERSE_AUTH_TTL_SEC;
+        this.enforceTokenSubjectNodeIdentity =
+            options.enforceTokenSubjectNodeIdentity ?? false;
     }
     get tokenVerifier() {
         return this.tokenVerifierImpl;
@@ -39981,6 +39995,13 @@ class OAuth2Authorizer {
             });
             return undefined;
         }
+        // Enforce token subject node identity if enabled
+        if (this.enforceTokenSubjectNodeIdentity) {
+            const validationResult = await this.validateTokenSubjectNodeIdentity(frame.systemId, claims);
+            if (!validationResult) {
+                return undefined;
+            }
+        }
         claims.instance_id = claims.instance_id ?? frame.instanceId;
         claims.assigned_path = claims.assigned_path ?? frame.assignedPath;
         claims.accepted_capabilities =
@@ -40058,6 +40079,33 @@ class OAuth2Authorizer {
         }
         return false;
     }
+    async validateTokenSubjectNodeIdentity(systemId, claims) {
+        const sub = claims.sub;
+        if (typeof sub !== 'string' || sub.trim().length === 0) {
+            logger$3.warning('oauth2_attach_missing_subject_claim', {
+                system_id: systemId,
+            });
+            return false;
+        }
+        const expectedPrefix = await generateIdAsync({
+            mode: 'fingerprint',
+            material: sub,
+            length: 8,
+        });
+        if (!systemId.startsWith(`${expectedPrefix}-`)) {
+            logger$3.warning('oauth2_attach_node_identity_mismatch', {
+                system_id: systemId,
+                expected_prefix: expectedPrefix,
+                subject: sub,
+            });
+            return false;
+        }
+        logger$3.debug('oauth2_attach_node_identity_verified', {
+            system_id: systemId,
+            expected_prefix: expectedPrefix,
+        });
+        return true;
+    }
 }
 
 var oauth2Authorizer = /*#__PURE__*/Object.freeze({

package/dist/cjs/naylence/fame/security/auth/oauth2-authorizer-factory.js

@@ -86,6 +86,7 @@ class OAuth2AuthorizerFactory extends authorizer_factory_js_1.AuthorizerFactory
             defaultTtlSec: normalized.defaultTtlSec,
             maxTtlSec: normalized.maxTtlSec,
             reverseAuthTtlSec: normalized.reverseAuthTtlSec,
+            enforceTokenSubjectNodeIdentity: normalized.enforceTokenSubjectNodeIdentity,
         };
         if (tokenIssuer) {
             authorizerOptions.tokenIssuer = tokenIssuer;
@@ -154,6 +155,11 @@ function normalizeConfig(config) {
         : typeof source.reverse_auth_ttl_sec === 'number'
             ? source.reverse_auth_ttl_sec
             : ttl_constants_js_1.DEFAULT_REVERSE_AUTH_TTL_SEC;
+    const enforceTokenSubjectNodeIdentity = typeof source.enforceTokenSubjectNodeIdentity === 'boolean'
+        ? source.enforceTokenSubjectNodeIdentity
+        : typeof source.enforce_token_subject_node_identity === 'boolean'
+            ? source.enforce_token_subject_node_identity
+            : false;
     const tokenVerifierConfigInput = source.tokenVerifierConfig ?? source.token_verifier_config ?? null;
     const tokenVerifierConfig = normalizeTokenVerifierConfig({
         config: tokenVerifierConfigInput,
@@ -172,6 +178,7 @@ function normalizeConfig(config) {
         maxTtlSec,
         tokenVerifierConfig,
         reverseAuthTtlSec: reverseAuthCandidate,
+        enforceTokenSubjectNodeIdentity,
         ...(audience ? { audience } : {}),
     };
     if (tokenIssuerConfig) {

package/dist/cjs/naylence/fame/security/auth/oauth2-authorizer.js

@@ -37,6 +37,10 @@ function normalizeOptions(raw) {
             : typeof snake.aud === 'string'
                 ? snake.aud
                 : undefined);
+    const enforceTokenSubjectNodeIdentity = camel.enforceTokenSubjectNodeIdentity ??
+        (typeof snake.enforce_token_subject_node_identity === 'boolean'
+            ? snake.enforce_token_subject_node_identity
+            : undefined);
     return {
         tokenVerifier,
         tokenIssuer,
@@ -46,6 +50,7 @@ function normalizeOptions(raw) {
         defaultTtlSec,
         maxTtlSec,
         reverseAuthTtlSec,
+        enforceTokenSubjectNodeIdentity,
     };
 }
 class OAuth2Authorizer {
@@ -59,6 +64,8 @@ class OAuth2Authorizer {
         this.requireScope = options.requireScope ?? true;
         this.reverseAuthTtlSec =
             options.reverseAuthTtlSec ?? ttl_constants_js_1.DEFAULT_REVERSE_AUTH_TTL_SEC;
+        this.enforceTokenSubjectNodeIdentity =
+            options.enforceTokenSubjectNodeIdentity ?? false;
     }
     get tokenVerifier() {
         return this.tokenVerifierImpl;
@@ -188,6 +195,13 @@ class OAuth2Authorizer {
             });
             return undefined;
         }
+        // Enforce token subject node identity if enabled
+        if (this.enforceTokenSubjectNodeIdentity) {
+            const validationResult = await this.validateTokenSubjectNodeIdentity(frame.systemId, claims);
+            if (!validationResult) {
+                return undefined;
+            }
+        }
         claims.instance_id = claims.instance_id ?? frame.instanceId;
         claims.assigned_path = claims.assigned_path ?? frame.assignedPath;
         claims.accepted_capabilities =
@@ -265,5 +279,32 @@ class OAuth2Authorizer {
         }
         return false;
     }
+    async validateTokenSubjectNodeIdentity(systemId, claims) {
+        const sub = claims.sub;
+        if (typeof sub !== 'string' || sub.trim().length === 0) {
+            logger.warning('oauth2_attach_missing_subject_claim', {
+                system_id: systemId,
+            });
+            return false;
+        }
+        const expectedPrefix = await (0, core_1.generateIdAsync)({
+            mode: 'fingerprint',
+            material: sub,
+            length: 8,
+        });
+        if (!systemId.startsWith(`${expectedPrefix}-`)) {
+            logger.warning('oauth2_attach_node_identity_mismatch', {
+                system_id: systemId,
+                expected_prefix: expectedPrefix,
+                subject: sub,
+            });
+            return false;
+        }
+        logger.debug('oauth2_attach_node_identity_verified', {
+            system_id: systemId,
+            expected_prefix: expectedPrefix,
+        });
+        return true;
+    }
 }
 exports.OAuth2Authorizer = OAuth2Authorizer;

package/dist/cjs/version.js

@@ -1,10 +1,10 @@
 "use strict";
 // This file is auto-generated during build - do not edit manually
-// Generated from package.json version: 0.3.16
+// Generated from package.json version: 0.3.17
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VERSION = void 0;
 /**
  * The package version, injected at build time.
  * @internal
  */
-exports.VERSION = '0.3.16';
+exports.VERSION = '0.3.17';

package/dist/esm/naylence/fame/security/auth/oauth2-authorizer-factory.js

@@ -50,6 +50,7 @@ export class OAuth2AuthorizerFactory extends AuthorizerFactory {
             defaultTtlSec: normalized.defaultTtlSec,
             maxTtlSec: normalized.maxTtlSec,
             reverseAuthTtlSec: normalized.reverseAuthTtlSec,
+            enforceTokenSubjectNodeIdentity: normalized.enforceTokenSubjectNodeIdentity,
         };
         if (tokenIssuer) {
             authorizerOptions.tokenIssuer = tokenIssuer;
@@ -117,6 +118,11 @@ function normalizeConfig(config) {
         : typeof source.reverse_auth_ttl_sec === 'number'
             ? source.reverse_auth_ttl_sec
             : DEFAULT_REVERSE_AUTH_TTL_SEC;
+    const enforceTokenSubjectNodeIdentity = typeof source.enforceTokenSubjectNodeIdentity === 'boolean'
+        ? source.enforceTokenSubjectNodeIdentity
+        : typeof source.enforce_token_subject_node_identity === 'boolean'
+            ? source.enforce_token_subject_node_identity
+            : false;
     const tokenVerifierConfigInput = source.tokenVerifierConfig ?? source.token_verifier_config ?? null;
     const tokenVerifierConfig = normalizeTokenVerifierConfig({
         config: tokenVerifierConfigInput,
@@ -135,6 +141,7 @@ function normalizeConfig(config) {
         maxTtlSec,
         tokenVerifierConfig,
         reverseAuthTtlSec: reverseAuthCandidate,
+        enforceTokenSubjectNodeIdentity,
         ...(audience ? { audience } : {}),
     };
     if (tokenIssuerConfig) {

package/dist/esm/naylence/fame/security/auth/oauth2-authorizer.js

@@ -1,4 +1,4 @@
-import { createAuthorizationContext } from '@naylence/core';
+import { createAuthorizationContext, generateIdAsync } from '@naylence/core';
 import { DEFAULT_REVERSE_AUTH_TTL_SEC } from '../../constants/ttl-constants.js';
 import { getLogger } from '../../util/logging.js';
 const logger = getLogger('naylence.fame.security.auth.oauth2_authorizer');
@@ -34,6 +34,10 @@ function normalizeOptions(raw) {
             : typeof snake.aud === 'string'
                 ? snake.aud
                 : undefined);
+    const enforceTokenSubjectNodeIdentity = camel.enforceTokenSubjectNodeIdentity ??
+        (typeof snake.enforce_token_subject_node_identity === 'boolean'
+            ? snake.enforce_token_subject_node_identity
+            : undefined);
     return {
         tokenVerifier,
         tokenIssuer,
@@ -43,6 +47,7 @@ function normalizeOptions(raw) {
         defaultTtlSec,
         maxTtlSec,
         reverseAuthTtlSec,
+        enforceTokenSubjectNodeIdentity,
     };
 }
 export class OAuth2Authorizer {
@@ -56,6 +61,8 @@ export class OAuth2Authorizer {
         this.requireScope = options.requireScope ?? true;
         this.reverseAuthTtlSec =
             options.reverseAuthTtlSec ?? DEFAULT_REVERSE_AUTH_TTL_SEC;
+        this.enforceTokenSubjectNodeIdentity =
+            options.enforceTokenSubjectNodeIdentity ?? false;
     }
     get tokenVerifier() {
         return this.tokenVerifierImpl;
@@ -185,6 +192,13 @@ export class OAuth2Authorizer {
             });
             return undefined;
         }
+        // Enforce token subject node identity if enabled
+        if (this.enforceTokenSubjectNodeIdentity) {
+            const validationResult = await this.validateTokenSubjectNodeIdentity(frame.systemId, claims);
+            if (!validationResult) {
+                return undefined;
+            }
+        }
         claims.instance_id = claims.instance_id ?? frame.instanceId;
         claims.assigned_path = claims.assigned_path ?? frame.assignedPath;
         claims.accepted_capabilities =
@@ -262,4 +276,31 @@ export class OAuth2Authorizer {
         }
         return false;
     }
+    async validateTokenSubjectNodeIdentity(systemId, claims) {
+        const sub = claims.sub;
+        if (typeof sub !== 'string' || sub.trim().length === 0) {
+            logger.warning('oauth2_attach_missing_subject_claim', {
+                system_id: systemId,
+            });
+            return false;
+        }
+        const expectedPrefix = await generateIdAsync({
+            mode: 'fingerprint',
+            material: sub,
+            length: 8,
+        });
+        if (!systemId.startsWith(`${expectedPrefix}-`)) {
+            logger.warning('oauth2_attach_node_identity_mismatch', {
+                system_id: systemId,
+                expected_prefix: expectedPrefix,
+                subject: sub,
+            });
+            return false;
+        }
+        logger.debug('oauth2_attach_node_identity_verified', {
+            system_id: systemId,
+            expected_prefix: expectedPrefix,
+        });
+        return true;
+    }
 }

package/dist/esm/version.js

@@ -1,7 +1,7 @@
 // This file is auto-generated during build - do not edit manually
-// Generated from package.json version: 0.3.16
+// Generated from package.json version: 0.3.17
 /**
  * The package version, injected at build time.
  * @internal
  */
-export const VERSION = '0.3.16';
+export const VERSION = '0.3.17';

package/dist/node/index.cjs

@@ -14,12 +14,12 @@ var fastify = require('fastify');
 var websocketPlugin = require('@fastify/websocket');
 
 // This file is auto-generated during build - do not edit manually
-// Generated from package.json version: 0.3.16
+// Generated from package.json version: 0.3.17
 /**
  * The package version, injected at build time.
  * @internal
  */
-const VERSION = '0.3.16';
+const VERSION = '0.3.17';
 
 /**
  * Fame protocol specific error classes with WebSocket close codes and proper inheritance.
@@ -33260,6 +33260,7 @@ class OAuth2AuthorizerFactory extends AuthorizerFactory {
             defaultTtlSec: normalized.defaultTtlSec,
             maxTtlSec: normalized.maxTtlSec,
             reverseAuthTtlSec: normalized.reverseAuthTtlSec,
+            enforceTokenSubjectNodeIdentity: normalized.enforceTokenSubjectNodeIdentity,
         };
         if (tokenIssuer) {
             authorizerOptions.tokenIssuer = tokenIssuer;
@@ -33327,6 +33328,11 @@ function normalizeConfig$c(config) {
         : typeof source.reverse_auth_ttl_sec === 'number'
             ? source.reverse_auth_ttl_sec
             : DEFAULT_REVERSE_AUTH_TTL_SEC;
+    const enforceTokenSubjectNodeIdentity = typeof source.enforceTokenSubjectNodeIdentity === 'boolean'
+        ? source.enforceTokenSubjectNodeIdentity
+        : typeof source.enforce_token_subject_node_identity === 'boolean'
+            ? source.enforce_token_subject_node_identity
+            : false;
     const tokenVerifierConfigInput = source.tokenVerifierConfig ?? source.token_verifier_config ?? null;
     const tokenVerifierConfig = normalizeTokenVerifierConfig({
         config: tokenVerifierConfigInput,
@@ -33345,6 +33351,7 @@ function normalizeConfig$c(config) {
         maxTtlSec,
         tokenVerifierConfig,
         reverseAuthTtlSec: reverseAuthCandidate,
+        enforceTokenSubjectNodeIdentity,
         ...(audience ? { audience } : {}),
     };
     if (tokenIssuerConfig) {
@@ -39634,6 +39641,10 @@ function normalizeOptions$4(raw) {
             : typeof snake.aud === 'string'
                 ? snake.aud
                 : undefined);
+    const enforceTokenSubjectNodeIdentity = camel.enforceTokenSubjectNodeIdentity ??
+        (typeof snake.enforce_token_subject_node_identity === 'boolean'
+            ? snake.enforce_token_subject_node_identity
+            : undefined);
     return {
         tokenVerifier,
         tokenIssuer,
@@ -39643,6 +39654,7 @@ function normalizeOptions$4(raw) {
         defaultTtlSec,
         maxTtlSec,
         reverseAuthTtlSec,
+        enforceTokenSubjectNodeIdentity,
     };
 }
 class OAuth2Authorizer {
@@ -39656,6 +39668,8 @@ class OAuth2Authorizer {
         this.requireScope = options.requireScope ?? true;
         this.reverseAuthTtlSec =
             options.reverseAuthTtlSec ?? DEFAULT_REVERSE_AUTH_TTL_SEC;
+        this.enforceTokenSubjectNodeIdentity =
+            options.enforceTokenSubjectNodeIdentity ?? false;
     }
     get tokenVerifier() {
         return this.tokenVerifierImpl;
@@ -39785,6 +39799,13 @@ class OAuth2Authorizer {
             });
             return undefined;
         }
+        // Enforce token subject node identity if enabled
+        if (this.enforceTokenSubjectNodeIdentity) {
+            const validationResult = await this.validateTokenSubjectNodeIdentity(frame.systemId, claims);
+            if (!validationResult) {
+                return undefined;
+            }
+        }
         claims.instance_id = claims.instance_id ?? frame.instanceId;
         claims.assigned_path = claims.assigned_path ?? frame.assignedPath;
         claims.accepted_capabilities =
@@ -39862,6 +39883,33 @@ class OAuth2Authorizer {
         }
         return false;
     }
+    async validateTokenSubjectNodeIdentity(systemId, claims) {
+        const sub = claims.sub;
+        if (typeof sub !== 'string' || sub.trim().length === 0) {
+            logger$3.warning('oauth2_attach_missing_subject_claim', {
+                system_id: systemId,
+            });
+            return false;
+        }
+        const expectedPrefix = await core.generateIdAsync({
+            mode: 'fingerprint',
+            material: sub,
+            length: 8,
+        });
+        if (!systemId.startsWith(`${expectedPrefix}-`)) {
+            logger$3.warning('oauth2_attach_node_identity_mismatch', {
+                system_id: systemId,
+                expected_prefix: expectedPrefix,
+                subject: sub,
+            });
+            return false;
+        }
+        logger$3.debug('oauth2_attach_node_identity_verified', {
+            system_id: systemId,
+            expected_prefix: expectedPrefix,
+        });
+        return true;
+    }
 }
 
 var oauth2Authorizer = /*#__PURE__*/Object.freeze({

package/dist/node/index.mjs

@@ -13,12 +13,12 @@ import fastify from 'fastify';
 import websocketPlugin from '@fastify/websocket';
 
 // This file is auto-generated during build - do not edit manually
-// Generated from package.json version: 0.3.16
+// Generated from package.json version: 0.3.17
 /**
  * The package version, injected at build time.
  * @internal
  */
-const VERSION = '0.3.16';
+const VERSION = '0.3.17';
 
 /**
  * Fame protocol specific error classes with WebSocket close codes and proper inheritance.
@@ -33259,6 +33259,7 @@ class OAuth2AuthorizerFactory extends AuthorizerFactory {
             defaultTtlSec: normalized.defaultTtlSec,
             maxTtlSec: normalized.maxTtlSec,
             reverseAuthTtlSec: normalized.reverseAuthTtlSec,
+            enforceTokenSubjectNodeIdentity: normalized.enforceTokenSubjectNodeIdentity,
         };
         if (tokenIssuer) {
             authorizerOptions.tokenIssuer = tokenIssuer;
@@ -33326,6 +33327,11 @@ function normalizeConfig$c(config) {
         : typeof source.reverse_auth_ttl_sec === 'number'
             ? source.reverse_auth_ttl_sec
             : DEFAULT_REVERSE_AUTH_TTL_SEC;
+    const enforceTokenSubjectNodeIdentity = typeof source.enforceTokenSubjectNodeIdentity === 'boolean'
+        ? source.enforceTokenSubjectNodeIdentity
+        : typeof source.enforce_token_subject_node_identity === 'boolean'
+            ? source.enforce_token_subject_node_identity
+            : false;
     const tokenVerifierConfigInput = source.tokenVerifierConfig ?? source.token_verifier_config ?? null;
     const tokenVerifierConfig = normalizeTokenVerifierConfig({
         config: tokenVerifierConfigInput,
@@ -33344,6 +33350,7 @@ function normalizeConfig$c(config) {
         maxTtlSec,
         tokenVerifierConfig,
         reverseAuthTtlSec: reverseAuthCandidate,
+        enforceTokenSubjectNodeIdentity,
         ...(audience ? { audience } : {}),
     };
     if (tokenIssuerConfig) {
@@ -39633,6 +39640,10 @@ function normalizeOptions$4(raw) {
             : typeof snake.aud === 'string'
                 ? snake.aud
                 : undefined);
+    const enforceTokenSubjectNodeIdentity = camel.enforceTokenSubjectNodeIdentity ??
+        (typeof snake.enforce_token_subject_node_identity === 'boolean'
+            ? snake.enforce_token_subject_node_identity
+            : undefined);
     return {
         tokenVerifier,
         tokenIssuer,
@@ -39642,6 +39653,7 @@ function normalizeOptions$4(raw) {
         defaultTtlSec,
         maxTtlSec,
         reverseAuthTtlSec,
+        enforceTokenSubjectNodeIdentity,
     };
 }
 class OAuth2Authorizer {
@@ -39655,6 +39667,8 @@ class OAuth2Authorizer {
         this.requireScope = options.requireScope ?? true;
         this.reverseAuthTtlSec =
             options.reverseAuthTtlSec ?? DEFAULT_REVERSE_AUTH_TTL_SEC;
+        this.enforceTokenSubjectNodeIdentity =
+            options.enforceTokenSubjectNodeIdentity ?? false;
     }
     get tokenVerifier() {
         return this.tokenVerifierImpl;
@@ -39784,6 +39798,13 @@ class OAuth2Authorizer {
             });
             return undefined;
         }
+        // Enforce token subject node identity if enabled
+        if (this.enforceTokenSubjectNodeIdentity) {
+            const validationResult = await this.validateTokenSubjectNodeIdentity(frame.systemId, claims);
+            if (!validationResult) {
+                return undefined;
+            }
+        }
         claims.instance_id = claims.instance_id ?? frame.instanceId;
         claims.assigned_path = claims.assigned_path ?? frame.assignedPath;
         claims.accepted_capabilities =
@@ -39861,6 +39882,33 @@ class OAuth2Authorizer {
         }
         return false;
     }
+    async validateTokenSubjectNodeIdentity(systemId, claims) {
+        const sub = claims.sub;
+        if (typeof sub !== 'string' || sub.trim().length === 0) {
+            logger$3.warning('oauth2_attach_missing_subject_claim', {
+                system_id: systemId,
+            });
+            return false;
+        }
+        const expectedPrefix = await generateIdAsync({
+            mode: 'fingerprint',
+            material: sub,
+            length: 8,
+        });
+        if (!systemId.startsWith(`${expectedPrefix}-`)) {
+            logger$3.warning('oauth2_attach_node_identity_mismatch', {
+                system_id: systemId,
+                expected_prefix: expectedPrefix,
+                subject: sub,
+            });
+            return false;
+        }
+        logger$3.debug('oauth2_attach_node_identity_verified', {
+            system_id: systemId,
+            expected_prefix: expectedPrefix,
+        });
+        return true;
+    }
 }
 
 var oauth2Authorizer = /*#__PURE__*/Object.freeze({

package/dist/node/node.cjs

@@ -4426,12 +4426,12 @@ async function ensureRuntimeFactoriesRegistered(registry = factory.Registry) {
 }
 
 // This file is auto-generated during build - do not edit manually
-// Generated from package.json version: 0.3.16
+// Generated from package.json version: 0.3.17
 /**
  * The package version, injected at build time.
  * @internal
  */
-const VERSION = '0.3.16';
+const VERSION = '0.3.17';
 
 let initialized = false;
 const runtimePlugin = {
@@ -38001,6 +38001,7 @@ class OAuth2AuthorizerFactory extends AuthorizerFactory {
             defaultTtlSec: normalized.defaultTtlSec,
             maxTtlSec: normalized.maxTtlSec,
             reverseAuthTtlSec: normalized.reverseAuthTtlSec,
+            enforceTokenSubjectNodeIdentity: normalized.enforceTokenSubjectNodeIdentity,
         };
         if (tokenIssuer) {
             authorizerOptions.tokenIssuer = tokenIssuer;
@@ -38068,6 +38069,11 @@ function normalizeConfig$c(config) {
         : typeof source.reverse_auth_ttl_sec === 'number'
             ? source.reverse_auth_ttl_sec
             : DEFAULT_REVERSE_AUTH_TTL_SEC;
+    const enforceTokenSubjectNodeIdentity = typeof source.enforceTokenSubjectNodeIdentity === 'boolean'
+        ? source.enforceTokenSubjectNodeIdentity
+        : typeof source.enforce_token_subject_node_identity === 'boolean'
+            ? source.enforce_token_subject_node_identity
+            : false;
     const tokenVerifierConfigInput = source.tokenVerifierConfig ?? source.token_verifier_config ?? null;
     const tokenVerifierConfig = normalizeTokenVerifierConfig({
         config: tokenVerifierConfigInput,
@@ -38086,6 +38092,7 @@ function normalizeConfig$c(config) {
         maxTtlSec,
         tokenVerifierConfig,
         reverseAuthTtlSec: reverseAuthCandidate,
+        enforceTokenSubjectNodeIdentity,
         ...(audience ? { audience } : {}),
     };
     if (tokenIssuerConfig) {
@@ -41968,6 +41975,10 @@ function normalizeOptions$4(raw) {
             : typeof snake.aud === 'string'
                 ? snake.aud
                 : undefined);
+    const enforceTokenSubjectNodeIdentity = camel.enforceTokenSubjectNodeIdentity ??
+        (typeof snake.enforce_token_subject_node_identity === 'boolean'
+            ? snake.enforce_token_subject_node_identity
+            : undefined);
     return {
         tokenVerifier,
         tokenIssuer,
@@ -41977,6 +41988,7 @@ function normalizeOptions$4(raw) {
         defaultTtlSec,
         maxTtlSec,
         reverseAuthTtlSec,
+        enforceTokenSubjectNodeIdentity,
     };
 }
 class OAuth2Authorizer {
@@ -41990,6 +42002,8 @@ class OAuth2Authorizer {
         this.requireScope = options.requireScope ?? true;
         this.reverseAuthTtlSec =
             options.reverseAuthTtlSec ?? DEFAULT_REVERSE_AUTH_TTL_SEC;
+        this.enforceTokenSubjectNodeIdentity =
+            options.enforceTokenSubjectNodeIdentity ?? false;
     }
     get tokenVerifier() {
         return this.tokenVerifierImpl;
@@ -42119,6 +42133,13 @@ class OAuth2Authorizer {
             });
             return undefined;
         }
+        // Enforce token subject node identity if enabled
+        if (this.enforceTokenSubjectNodeIdentity) {
+            const validationResult = await this.validateTokenSubjectNodeIdentity(frame.systemId, claims);
+            if (!validationResult) {
+                return undefined;
+            }
+        }
         claims.instance_id = claims.instance_id ?? frame.instanceId;
         claims.assigned_path = claims.assigned_path ?? frame.assignedPath;
         claims.accepted_capabilities =
@@ -42196,6 +42217,33 @@ class OAuth2Authorizer {
         }
         return false;
     }
+    async validateTokenSubjectNodeIdentity(systemId, claims) {
+        const sub = claims.sub;
+        if (typeof sub !== 'string' || sub.trim().length === 0) {
+            logger$3.warning('oauth2_attach_missing_subject_claim', {
+                system_id: systemId,
+            });
+            return false;
+        }
+        const expectedPrefix = await core.generateIdAsync({
+            mode: 'fingerprint',
+            material: sub,
+            length: 8,
+        });
+        if (!systemId.startsWith(`${expectedPrefix}-`)) {
+            logger$3.warning('oauth2_attach_node_identity_mismatch', {
+                system_id: systemId,
+                expected_prefix: expectedPrefix,
+                subject: sub,
+            });
+            return false;
+        }
+        logger$3.debug('oauth2_attach_node_identity_verified', {
+            system_id: systemId,
+            expected_prefix: expectedPrefix,
+        });
+        return true;
+    }
 }
 
 var oauth2Authorizer = /*#__PURE__*/Object.freeze({

package/dist/node/node.mjs

@@ -4425,12 +4425,12 @@ async function ensureRuntimeFactoriesRegistered(registry = Registry) {
 }
 
 // This file is auto-generated during build - do not edit manually
-// Generated from package.json version: 0.3.16
+// Generated from package.json version: 0.3.17
 /**
  * The package version, injected at build time.
  * @internal
  */
-const VERSION = '0.3.16';
+const VERSION = '0.3.17';
 
 let initialized = false;
 const runtimePlugin = {
@@ -38000,6 +38000,7 @@ class OAuth2AuthorizerFactory extends AuthorizerFactory {
             defaultTtlSec: normalized.defaultTtlSec,
             maxTtlSec: normalized.maxTtlSec,
             reverseAuthTtlSec: normalized.reverseAuthTtlSec,
+            enforceTokenSubjectNodeIdentity: normalized.enforceTokenSubjectNodeIdentity,
         };
         if (tokenIssuer) {
             authorizerOptions.tokenIssuer = tokenIssuer;
@@ -38067,6 +38068,11 @@ function normalizeConfig$c(config) {
         : typeof source.reverse_auth_ttl_sec === 'number'
             ? source.reverse_auth_ttl_sec
             : DEFAULT_REVERSE_AUTH_TTL_SEC;
+    const enforceTokenSubjectNodeIdentity = typeof source.enforceTokenSubjectNodeIdentity === 'boolean'
+        ? source.enforceTokenSubjectNodeIdentity
+        : typeof source.enforce_token_subject_node_identity === 'boolean'
+            ? source.enforce_token_subject_node_identity
+            : false;
     const tokenVerifierConfigInput = source.tokenVerifierConfig ?? source.token_verifier_config ?? null;
     const tokenVerifierConfig = normalizeTokenVerifierConfig({
         config: tokenVerifierConfigInput,
@@ -38085,6 +38091,7 @@ function normalizeConfig$c(config) {
         maxTtlSec,
         tokenVerifierConfig,
         reverseAuthTtlSec: reverseAuthCandidate,
+        enforceTokenSubjectNodeIdentity,
         ...(audience ? { audience } : {}),
     };
     if (tokenIssuerConfig) {
@@ -41967,6 +41974,10 @@ function normalizeOptions$4(raw) {
             : typeof snake.aud === 'string'
                 ? snake.aud
                 : undefined);
+    const enforceTokenSubjectNodeIdentity = camel.enforceTokenSubjectNodeIdentity ??
+        (typeof snake.enforce_token_subject_node_identity === 'boolean'
+            ? snake.enforce_token_subject_node_identity
+            : undefined);
     return {
         tokenVerifier,
         tokenIssuer,
@@ -41976,6 +41987,7 @@ function normalizeOptions$4(raw) {
         defaultTtlSec,
         maxTtlSec,
         reverseAuthTtlSec,
+        enforceTokenSubjectNodeIdentity,
     };
 }
 class OAuth2Authorizer {
@@ -41989,6 +42001,8 @@ class OAuth2Authorizer {
         this.requireScope = options.requireScope ?? true;
         this.reverseAuthTtlSec =
             options.reverseAuthTtlSec ?? DEFAULT_REVERSE_AUTH_TTL_SEC;
+        this.enforceTokenSubjectNodeIdentity =
+            options.enforceTokenSubjectNodeIdentity ?? false;
     }
     get tokenVerifier() {
         return this.tokenVerifierImpl;
@@ -42118,6 +42132,13 @@ class OAuth2Authorizer {
             });
             return undefined;
         }
+        // Enforce token subject node identity if enabled
+        if (this.enforceTokenSubjectNodeIdentity) {
+            const validationResult = await this.validateTokenSubjectNodeIdentity(frame.systemId, claims);
+            if (!validationResult) {
+                return undefined;
+            }
+        }
         claims.instance_id = claims.instance_id ?? frame.instanceId;
         claims.assigned_path = claims.assigned_path ?? frame.assignedPath;
         claims.accepted_capabilities =
@@ -42195,6 +42216,33 @@ class OAuth2Authorizer {
         }
         return false;
     }
+    async validateTokenSubjectNodeIdentity(systemId, claims) {
+        const sub = claims.sub;
+        if (typeof sub !== 'string' || sub.trim().length === 0) {
+            logger$3.warning('oauth2_attach_missing_subject_claim', {
+                system_id: systemId,
+            });
+            return false;
+        }
+        const expectedPrefix = await generateIdAsync({
+            mode: 'fingerprint',
+            material: sub,
+            length: 8,
+        });
+        if (!systemId.startsWith(`${expectedPrefix}-`)) {
+            logger$3.warning('oauth2_attach_node_identity_mismatch', {
+                system_id: systemId,
+                expected_prefix: expectedPrefix,
+                subject: sub,
+            });
+            return false;
+        }
+        logger$3.debug('oauth2_attach_node_identity_verified', {
+            system_id: systemId,
+            expected_prefix: expectedPrefix,
+        });
+        return true;
+    }
 }
 
 var oauth2Authorizer = /*#__PURE__*/Object.freeze({

package/dist/types/naylence/fame/security/auth/oauth2-authorizer-factory.d.ts

@@ -23,6 +23,8 @@ export interface OAuth2AuthorizerConfig extends AuthorizerConfig {
     token_issuer_config?: TokenIssuerConfig;
     reverseAuthTtlSec?: number;
     reverse_auth_ttl_sec?: number;
+    enforceTokenSubjectNodeIdentity?: boolean;
+    enforce_token_subject_node_identity?: boolean;
 }
 export declare const FACTORY_META: {
     readonly base: "AuthorizerFactory";

package/dist/types/naylence/fame/security/auth/oauth2-authorizer.d.ts

@@ -14,6 +14,7 @@ export interface OAuth2AuthorizerOptions {
     defaultTtlSec?: number;
     maxTtlSec?: number;
     reverseAuthTtlSec?: number;
+    enforceTokenSubjectNodeIdentity?: boolean;
 }
 export declare class OAuth2Authorizer implements Authorizer, TokenVerifierProvider, NodeEventListener {
     readonly priority = 1000;
@@ -23,6 +24,7 @@ export declare class OAuth2Authorizer implements Authorizer, TokenVerifierProvid
     private readonly requiredScopes;
     private readonly requireScope;
     private readonly reverseAuthTtlSec;
+    private readonly enforceTokenSubjectNodeIdentity;
     private node?;
     constructor(rawOptions: OAuth2AuthorizerOptions | Record<string, unknown>);
     get tokenVerifier(): TokenVerifier;
@@ -35,4 +37,5 @@ export declare class OAuth2Authorizer implements Authorizer, TokenVerifierProvid
     private extractScopes;
     private mergeScopes;
     private hasRequiredScope;
+    private validateTokenSubjectNodeIdentity;
 }

package/dist/types/version.d.ts

@@ -2,4 +2,4 @@
  * The package version, injected at build time.
  * @internal
  */
-export declare const VERSION = "0.3.16";
+export declare const VERSION = "0.3.17";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naylence/runtime",
-  "version": "0.3.16",
+  "version": "0.3.17",
   "type": "module",
   "description": "Naylence Runtime - Complete TypeScript runtime",
   "author": "Naylence Dev <naylencedev@gmail.com>",